CVE-2023-1055: Infoleak
A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.
Other sources
In RHDS 11 and 12 while browsing entries, the LDAP Browser tries to decode a user certificate on the server, but instead of decoding a userCertificate attribute, it tries to decode userPassword attribute. This leaks a hashed password in the process list as an argument.
The possible issue is caused by the showCertificate() function that does the decoding here: https://github.com/389ds/389-ds-base/blob/c69f2691bb9c3933c1ff3f81139011fc7d66b0aa/src/cockpit/389-console/src/lib/ldapeditor/lib/utils.jsx#L989-L997
This code is present in all versions of RHDS that ship LDAP Browser (12.0, 12.1 and 11.5, 11.6).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-1055?
CVE-2023-1055 is a vulnerability found in RHDS 11 and RHDS 12 that could allow sensitive information to be leaked.
How does CVE-2023-1055 affect the affected software?
CVE-2023-1055 affects RHDS 11.5, 11.6, 12.0, 12.1, Fedora 36, 37, and 38.
What is the severity of CVE-2023-1055?
CVE-2023-1055 has a severity of medium (CVSS score of 5.5).
How can an attacker exploit CVE-2023-1055?
An attacker with a local account where the cockpit-389-ds is running can list the processes and potentially access sensitive information.
Is there a fix available for CVE-2023-1055?
Yes, fixed versions of the affected software are available. Please refer to the references for more information.